External risk intelligence

iOS and iPadOS Out-of-Bounds Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64772

This vulnerability affects client-side operating systems (iOS, iPadOS, macOS, tvOS, visionOS). While a remote attacker might trigger it via malicious content, these products are personal computing and mobile devices rather than internet-facing infrastructure services, edge gateways, or public-facing servers designed to be reached directly from the internet in common deployment patterns.

Out-of-bounds Write

Apple Ipados

before 26.615.0 to before 15.7.826.0 to before 26.6

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves an out-of-bounds write that could lead to application termination or heap corruption, affecting Apple's operating systems. While technically exploitable remotely without user interaction, its impact is primarily on client devices rather than critical infrastructure. The main concern is confirming whether your organization utilizes these specific operating systems in a way that could be targeted.

Flaw allows unexpected application crashes remotely.
Impacts personal and mobile Apple devices.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to a vulnerable application. This could lead to unexpected application termination or memory corruption, potentially allowing for further compromise.

No user interaction needed.
Malicious data sent remotely.
Application crash or corruption.

Live Threat

Current exploitation, exposure, and threat context

An out-of-bounds write in the affected operating systems could allow a remote attacker to cause applications to unexpectedly terminate or corrupt memory. This could occur when a user interacts with specially crafted content delivered over the network.

System stability and application integrity.
Via malformed network content.
Application crashes and unexpected behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects client-side operating systems, meaning the primary responsibility for remediation likely lies with individual users or device owners who manage their own systems, rather than centralized IT teams. The first practical step is for users to confirm they are running an affected operating system and that it is kept up-to-date to receive security patches, with business-critical systems requiring faster review.

Device owners should own the issue.
Verify operating system and update status.
Update affected devices promptly.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-64772?

This CVE affects the core operating systems powering Apple's ecosystem, specifically iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. These platforms provide the fundamental environment for running applications on iPhones, iPads, Mac computers, Apple TV, and Apple Vision Pro devices. The vulnerability resides within the system components that handle incoming data, which are shared across these diverse device types.

What does out-of-bounds write mean for this vulnerability?

Classified as CWE-787, an out-of-bounds write happens when software writes data past the intended memory boundary. Think of it like trying to store information in a box that is already full; the data spills over into neighboring memory locations. In the context of CVE-2026-64772, this flaw allows unauthorized memory access that can corrupt vital application data or cause the software to crash unexpectedly.

How does an attacker trigger this vulnerability?

The flaw is triggered when an application processes specially crafted data delivered over a network. It does not require a user to click a link or open a file manually; the mere handling of the malformed content is sufficient to initiate the faulty write process. Note that simply having an affected device powered on or connected to a standard local network does not automatically trigger the issue without the specific, malicious data payload being sent to an application.

Why should I care about CVE-2026-64772?

Halo Surface Signal notes that because these are client-side operating systems rather than public-facing servers or edge gateways, they are not typically exposed to the internet in the same way infrastructure is. However, you should still care if your devices process untrusted network content. The severity lies in the potential for remote, interaction-free memory corruption on devices that likely contain your personal or professional data.

What is the first step to address this vulnerability?

The primary response is to verify your current software version on all affected Apple devices. Since this is a client-side operating system issue, the most effective remediation is to install the provided security updates—iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, or visionOS 26.6—as soon as they are available. Ensure that devices used for business-critical tasks are prioritized for these updates to maintain system integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.